Deterministic threshold elliptic curve digital signature generation method and participant

Abstract

The invention discloses a deterministic threshold elliptic curve digital signature generation method and participants, and the method comprises the steps: two participants generate respective signature share parameters and related certificates according to a to-be-signed message and respective signature keys based on a pseudo-random function and point multiplication operation on an elliptic curve; verifying signature share parameters and related certificates of the opposite side according to own verification keys; if verification is passed, common signature parameters are calculated according to signature share parameters of the two parties; generating respective signature shares according to the message to be signed, the common signature parameter, the joint public key and respective signature private keys; and finally, generating an integral digital signature according to the signature share of each party and the signature share of each other. The generation efficiency of the digital signature can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of encryption technology, and in particular relates to a deterministic threshold elliptic curve digital signature generation method and participants. Background Art

[0002] With the rapid development of the Internet, digitalization has penetrated into all aspects of social life, giving people more convenient ways to communicate, entertain and conduct business. However, this has also caused many information security issues, such as privacy leakage, cyber attacks, data tampering and identity impersonation. These issues make it particularly important to ensure the confidentiality, integrity and authenticity of information.

[0003] In this context, cryptography research has become the key to ensuring information security. It provides technical support for confidentiality, integrity, authentication and non-repudiation through encryption, decryption, digital signatures and hash functions. Encryption ensures that only authorized parties can access information to prevent unauthorized theft; identity authentication ensures the authenticity of the source of information. Digital signatures play a vital role in modern cryptography and are widely used in military, e-commerce and e-government.

[0004] In cryptography, the security of the key system is attributed to the difficulty of calculating a mathematical problem. The three classic public key systems are: asymmetric encryption system (Rivest-Shamir-Adleman, RSA), asymmetric encryption algorithm system based on Diffie-Hellman key exchange (ElGamal), and elliptic curve cryptography (Elliptic Curve Cryptography, ECC). They are based on three difficult problems: integer factorization, discrete logarithm calculation and elliptic curve discrete logarithm calculation.

[0005] Schnorr digital signature is a variant of ElGamal, and its security is based on the discrete logarithm problem. It is widely used in various applications due to its simplicity, provable security and linear structure. A deterministic variant of Schnorr signature (called stateless signature) uses a message and a long-term secret pseudorandom function (PRF) to derive random parameters in a stateless manner. It has attracted attention because it reduces the dangers of errors in the direct use of random generators or poor randomness selection.

[0006] In recent years, with the widespread application of Schnorr signatures, people have tried to use threshold signatures to strengthen the key protection mechanism of Schnorr signatures to alleviate the single point failure problem when storing and using such keys. Threshold signatures allow their keys to be secretly shared among multiple devices, and a set of these devices that meet the threshold number of people use the key to perform signing operations in an interactive manner. However, the threshold protocols of Schnorr deterministic variants have been very inefficient so far because they use nonlinear PRF functions to calculate the random parameters used in the signature.

[0007] Therefore, current digital signature generation methods are inefficient. Summary of the invention

[0008] The embodiment of the present invention provides a deterministic threshold elliptic curve digital signature generation method and participants, which can solve the problem that the current digital signature generation method is relatively inefficient.

[0009] In a first aspect, an embodiment of the present invention provides a method for generating a deterministic threshold elliptic curve digital signature, the method comprising:

[0010] Based on the pseudo-random function and the point multiplication operation on the elliptic curve, the signature share parameters and related certificates of the participant are generated according to the signature key of the participant and the message to be signed; and the signature share parameters and related certificates of the participant are sent to the other participant;

[0011] Verify the signature share parameters and related proofs of another participant based on the verification key of the participant;

[0012] If the verification is successful, the signature parameters are calculated based on the signature share parameters of the participant and the other participant;

[0013] Generate the signature share of the participant according to the signature parameters, the message to be signed, the joint public key, and the signature private key of the participant, and send the signature share of the participant to the other participant;

[0014] Generates a digital signature of the message to be signed based on the signature shares of the participant and another participant.

[0015] In a second aspect, an embodiment of the present invention provides a deterministic threshold elliptic curve digital signature generation participant, the participant comprising a signature module, a communication module and a verification module;

[0016] The signature module is used to generate the signature share parameters and related proofs of the participants according to the signature key of the participants and the message to be signed based on the pseudo-random function and the point multiplication operation on the elliptic curve;

[0017] The communication module is used to send the signature share parameters and related certificates of the participant to another participant, and receive the signature share parameters and related certificates of another participant;

[0018] The verification module is used to verify the signature share parameters and related proofs of another participant based on the verification key of the participant;

[0019] If the verification is successful, the signature module is further used to calculate the signature parameters according to the signature share parameters of the participant and another participant, and generate the signature share of the participant according to the signature parameters, the message to be signed, the joint public key, and the signature private key of the participant;

[0020] The communication module is also used to send a participant's signature share to another participant and receive another participant's signature share;

[0021] The signature module is also used to generate a digital signature of the message to be signed based on the signature shares of the participant and another participant.

[0022] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: according to the signature method provided by the present invention, two parties respectively generate their own random parameters based on the point multiplication operation and pseudo-random function on the elliptic curve, and then generate their own signature shares and merge them to obtain a digital signature; under the consideration of the same security level, the point multiplication operation on the elliptic curve can be used to replace the power multiplication operation on the large integer field when using a nonlinear pseudo-random function in the traditional Schnorr signature, providing a smaller key size; thereby, the distributed deterministic threshold signature scheme based on the Schnorr signature can be combined with the elliptic curve cryptography system to obtain a more efficient and compact signature method. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a structural diagram of a deterministic threshold elliptic curve digital signature generation system;

[0024] Figure 2 A flowchart of a system initialization method provided by an embodiment of the present invention;

[0025] Figure 3 A flowchart of a method for generating a deterministic threshold elliptic curve digital signature provided by an embodiment of the present invention;

[0026] Figure 4 A structural diagram of a deterministic threshold elliptic curve digital signature generation participant provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0028] Figure 1 The structure diagram of a deterministic threshold elliptic curve digital signature generation system provided by an embodiment of the present invention is shown. As an example but not a limitation, the system 100 may include at least one pair of participants, namely, the participant 110 and the participant 120.

[0029] Exemplarily, party 110 or party 120 can generate their own signature share parameters and related certificates based on the message to be signed and their own signature keys based on pseudo-random functions and point multiplication operations on elliptic curves, and send their own signature share parameters and related certificates to the other party. Then each party verifies the other party's signature share parameters and related certificates based on its own verification key. If the verification is successful, each party calculates a common signature parameter based on its own and the other party's signature share parameters; generates their own signature share based on the message to be signed, the common signature parameter and the joint public key, and their own signature private key and sends it to the other party. Finally, each party generates an overall digital signature based on its own and the other party's signature share.

[0030] Optionally, the system 100 may further include at least one verifier 130, which may verify whether the digital signature generated by the participant is correct. If correct, the digital signature corresponding to the message to be signed is accepted and saved, and if incorrect, an error message is returned.

[0031] According to the system provided by the present invention, by using the point multiplication operation on the elliptic curve to replace the power multiplication operation on the large integer field in the traditional Schnorr signature, a smaller key size can be provided, thereby reducing the amount of calculation and improving efficiency.

[0032] Figure 2 The flowchart of the implementation of a system initialization method provided by an embodiment of the present invention is shown. The method 200 can be applied to the above-mentioned system 100, and generates corresponding preparation parameters as an initialization method of the system 100. As an example but not a limitation, the method 200 can include steps S201-S204, and each step is described below.

[0033] S201, generating common parameters.

[0034] Exemplarily, the public parameters may be jointly generated by the participants in the system 100 .

[0035] Specifically, the participants can generate basic public parameters (G, G, q), collision-safe hash functions H, and the number η of possible verifier secret parameters Δ. Where G is the elliptic curve group, G is the generator of group G, and q is the order of group G.

[0036] Exemplarily, the module of the group G satisfies: |G|=κ, where κ is a security parameter. And the order q of the group G satisfies q<2l(κ) / 2-2 to ensure the security of the digital signature, where l(κ) represents the key length required to achieve the security parameter κ.

[0037] Exemplarily, the hash function may satisfy: H:{0,1}*→{0,1}n(κ), where * represents non-zero, κ≤n(κ)≤poly(κ), and poly(κ) represents a polynomial with κ as a parameter.

[0038] For example, η=1 / εκ is an integer, and η≥2ln(2)l2κ, η<2l(κ) / 2-2, q and η are relatively prime. Wherein, εκ=ε(κ), ε(·) is an error function, which indicates the degree of error or unreliability allowed by the system under given security parameters.

[0039] S202, generate initial signature parameters and secret parameters.

[0040] Exemplarily, the initial signature parameters may include: a first elliptic curve point, a second elliptic curve point, and a modulus.

[0041] In one example, a participant Pi, i∈{0,1} may generate a first initial random number and the second initial random number Calculate the points corresponding to the first and second initial random numbers on the elliptic curve, that is, the first elliptic curve point Second elliptic curve point Then according to Generates its own signing key for generating random parameters and a verification key used to verify that the random parameters of the other party are correct

[0042] For example, the first elliptic curve point and the second elliptic curve point The following formula can be satisfied:

[0043]

[0044] Among them, the first elliptic curve point can also be expressed in the form of coordinates as The second elliptic curve point can be expressed as

[0045] Exemplarily, the participant Pi may set a smaller modulus according to the coordinates of the second elliptic curve point

[0046]

[0047] In one example, another party p1-i may randomly select a secret parameter for party Pi.

[0048] Exemplarily, the secret parameter Δi of the participant may satisfy:

[0049] S203, generating a signature key and a verification key according to the initial signature parameters and the secret parameters.

[0050] In one example, party Pi may generate its own signature key and verification key according to its own first and second elliptic curve points, modulus, and secret parameters.

[0051] For example, the signing key Can satisfy: Verification Key Can satisfy: Among them It can be based on the key generation algorithm in the pseudo-random function: Generated, ⊥ represents the stop symbol.

[0052] S204, generate a signature private key and a joint public key.

[0053] In one example, the participant Pi can select a random number ski←Zq as the signature private key, where Zq is a field or finite field modulo q. Then, the signature public key pki=ski·G is calculated based on the signature private key ski. After receiving the signature public key pk1-i sent by another participant P1-i, the two participants Pi jointly generate a joint public key pk=pki+pk1-i.

[0054] Figure 3 The flowchart of the implementation of a deterministic threshold elliptic curve digital signature generation method provided by an embodiment of the present invention is shown. As an example but not a limitation, the method 300 may include steps S301-S307, and the method 300 may be applied to any participant in the above system 100. The method 300 may be used for entity authentication and message authentication in a communication network.

[0055] S301, based on a pseudo-random function and a point multiplication operation on an elliptic curve, generates the signature share parameters and related certificates of the participants according to the signature keys of the participants and the message to be signed.

[0056] In a possible implementation, the participant can generate the first random parameter and the second random parameter of the participant based on the pseudo-random function, according to the participant's signature key and the message to be signed, and find the parameter group of the participant that meets the preset conditions. Then, based on the point multiplication operation on the elliptic curve, the first signature parameter and the second signature parameter of the participant are generated according to the participant's parameter group and the participant's second random parameter respectively. Finally, the relevant proof of the participant is generated according to the participant's parameter group, the first signature parameter, the second signature parameter and the third random number. At the same time, the signature share parameter of the participant is generated according to the participant's first random parameter.

[0057] In one example, the participant may generate the first random parameter and the second random parameter of the participant based on an evaluation function in a pseudo-random function: PCF.Eval(·).

[0058] Exemplarily, the first random parameter and the second random parameter of the participant may satisfy the following formula:

[0059]

[0060] Among them, ui is the first random parameter of the participant, vi is the second random parameter of the participant, m is the message to be signed, It is the parameter in the signing key.

[0061] In one example, the parameter group The preset conditions that are met can be expressed as:

[0062]

[0063] in, is the first parameter in the parameter group of participant Pi, is the second parameter in the parameter group of participant Pi, Mi is the modulus of the participant, and ui is the first random parameter of the participant.

[0064] In one example, the first signature parameter and the second signature parameter may satisfy the following formula:

[0065]

[0066] ti=vi·G

[0067] Among them, si is the first signature parameter of participant Pi, is the second parameter in the participant's parameter group, G is the generator of the elliptic curve group; ti is the second signature parameter of participant Pi, and vi is the second random parameter.

[0068] In one example, the parties' relevant proof satisfy:

[0069] In one example, the signature share parameters used by the participants to generate the signature share The following formula can be satisfied:

[0070]

[0071] in q is the order of the elliptic curve group.

[0072] S302, sending the signature share parameters and related certificates of the participant to the other participant.

[0073] Accordingly, the signature share parameters and related proofs of the other party are received.

[0074] S303, verify the signature share parameters and related certificates of another participant according to the verification key of the participant.

[0075] In a possible implementation, a participant can generate verification parameters for another participant based on a pseudo-random function and according to the verification key of the participant. Then, the relevant proof of the other participant is disassembled to obtain the parameters in its relevant proof, such as the parameter group of the other participant and the first, second, and third signature parameters. Then, the verification parameter is calibrated according to the parameter group of the other participant to obtain the verification parameter calibration value of the other participant. Finally, the signature share parameter of the other participant, the parameters in its relevant proof, and the verification parameter calibration value are verified by the verification model to see whether they meet the various conditions in the verification model. If they meet, it means that the relevant proof and signature share parameters generated by the other participant have passed the Vector Oblivious Linear Evaluation (VOLE) correlation test, and the following step S304 can be performed to continue generating the digital signature. If not, the process can be stopped and the signature can be interrupted.

[0076] In one example, the verification parameter w1-i of the other party may satisfy: in Parameters in the key are verified for the parties.

[0077] In one example, the calibration value of the verification parameter by another party may satisfy the following formula:

[0078]

[0079] in, is the calibration value of the verification parameter of the other participant, M1-i is the modulus of the other participant, is the first parameter in the parameter group of the other participant, and Δ1-i is the secret parameter of the other parameter group, which is generated by the participant.

[0080] In one example, the verification model may satisfy the following formula:

[0081]

[0082] in, is the first parameter in the parameter group of the other participant p1-i, is the first elliptic curve point of the other party, M1-i is the modulus of the other party, is the verification parameter calibration value of the other party, G is the generator of the elliptic curve group, t1-i is the second signature parameter of the other party, Δ1-i is the secret parameter of the other party, s1-i is the first signature parameter of the other party, V1-i is the third signature parameter of the other party, The signature share parameter of the other party.

[0083] Exemplarily, the third signature parameter V1-i of the other party may be the product of the second random parameter of the other party and the generator G.

[0084] S304, calculating signature parameters according to the signature share parameters of the participant and another participant.

[0085] Exemplarily, the signature parameter Rm may satisfy:

[0086] S305, generating the signature share of the participant according to the signature parameters, the message to be signed, the joint public key and the signature private key.

[0087] Exemplarily, the signature shares of the participants may satisfy the following formula:

[0088]

[0089] Among them, si is the signature share of the participant.

[0090] S306, sending the participant's signature share to the other participant.

[0091] Accordingly, the signature share of the other party is received.

[0092] S307, generating a digital signature of the message to be signed based on the signature shares of the participant and another participant.

[0093] Exemplarily, the digital signature may include (s, Rm), where s=s0+s1.

[0094] Optionally, method 300 may further include step S308.

[0095] S308, sending the digital signature and the message to be signed to the verifier so that the verifier can verify whether the digital signature is legal based on the message to be signed.

[0096] For example, any participant can send a digital signature (s, Rm) and a message m to be signed to the verifier. The verifier can first calculate the hash value h = H (Rm, pk, m) of the message m, and then calculate the verification parameter Rver = s·Gh·pk of the verifier based on the joint public key, and finally determine whether the verification parameter of the verifier is equal to the value of the signature parameter Rm generated by the participant. If the two are equal, it means that the digital signature is legal, otherwise the verifier can refuse to believe the authenticity of the signature source and the signature content.

[0097] Since the present invention generates digital signatures based on the elliptic curve cryptography system, its security can be reflected by the difficulty of the discrete logarithm problem on the elliptic curve. If there is an attacker who wants to solve the signature private key of a certain participant by combining the public key, then he needs to solve the discrete logarithm problem on the elliptic curve, which is theoretically not feasible. Similarly, even if the attacker obtains the signature parameters in the digital signature, if he wants to crack any message about the random parameters of the participant based on the signature parameters, he also needs to solve the discrete logarithm problem on the elliptic curve. Therefore, the signature method provided by the present invention can be secure.

[0098] Furthermore, since only the party holding the signature private key can generate a valid digital signature, the verifier can only verify the validity of the signature through the joint public key, and the present invention also has authentication. Through the signing process and verification process in method 300, the signature recipient can ensure that the message has not been tampered with or modified during transmission. If an attempt is made to forge a message, the attacker must guess a linear function value related to the secret parameter, but the probability that the forged value can meet the verification condition wlo-v=uloΔ is low, so the signature method provided by the present invention also has integrity. Since the party cannot deny the fact that it has signed a specific message and the verifier can use the joint public key to verify the validity of the signature, the present invention also has non-repudiation.

[0099] Therefore, according to the signature method provided by the present invention, two parties generate their own random parameters based on the point multiplication operation and pseudo-random function on the elliptic curve respectively, and then generate their own signature shares and merge them to obtain a digital signature; under the consideration of the same security level, the point multiplication operation on the elliptic curve can be used to replace the power multiplication operation on the large integer field when using nonlinear pseudo-random functions in the traditional Schnorr signature, providing a smaller key size; thereby, the distributed deterministic threshold signature scheme based on the Schnorr signature can be combined with the elliptic curve cryptography system to obtain a more efficient and compact signature method.

[0100] Figure 4 The structure diagram of a deterministic threshold elliptic curve digital signature generation participant provided by an embodiment of the present invention is shown. As an example and not a limitation, Figure 4 The participant shown in may be the participant 110 or the participant 120 in the above-mentioned system 100.

[0101] In some embodiments, the participating party may include a signature module 11 , a communication module 12 and a verification module 13 .

[0102] Exemplarily, the signature module is used to generate the signature share parameters and related certificates of the participant according to the signature key of the participant and the message to be signed based on a pseudo-random function and a point multiplication operation on an elliptic curve; the communication module is used to send the signature share parameters and related certificates of the participant to another participant, and receive the signature share parameters and related certificates of the other participant; the verification module is used to verify the signature share parameters and related certificates of the other participant according to the verification key of the participant; if the verification is successful, the signature module is also used to calculate the signature parameters according to the signature share parameters of the participant and the other participant, and generate the signature share of the participant according to the signature parameters, the message to be signed, the joint public key, and the signature private key of the participant; the communication module is also used to send the signature share of the participant to another participant, and receive the signature share of the other participant; the signature module is also used to generate a digital signature of the message to be signed according to the signature shares of the participant and the other participant.

[0103] In one possible implementation, the signature module can be specifically used to: generate the first random parameter and the second random parameter of the participant according to the signature key of the participant and the message to be signed based on a pseudo-random function; find the parameter group of the participant that meets the preset conditions; based on the point multiplication operation on the elliptic curve, generate the first signature parameter and the second signature parameter of the participant according to the parameter group of the participant and the second random parameter of the participant respectively; generate the relevant proof of the participant according to the parameter group of the participant, the first signature parameter of the participant, the second signature parameter of the participant and the second random number of the participant; generate the signature share parameter of the participant according to the first random parameter of the participant.

[0104] Exemplarily, the first signature parameter may satisfy the following formula:

[0105]

[0106] Where si is the first signature parameter of participant Pi, i=0,1; is the second parameter in the participant's parameter group, and G is the generator of the elliptic curve group.

[0107] Exemplarily, the second signature parameter may satisfy the following formula:

[0108] ti=vi·G

[0109] Among them, ti is the second signature parameter of participant Pi, and vi is the second random parameter.

[0110] In one possible implementation, the verification module can be specifically used to: generate the verification parameters of another participant based on the verification key of the participant based on a pseudo-random function; disassemble the relevant proof of the other participant to obtain the parameter group, first signature parameter, second signature parameter and third signature parameter of the other participant, wherein the third signature parameter of the other participant is generated based on the second random number of the other participant; calibrate the verification parameters of the other participant based on the parameter group of the other participant to obtain the verification parameter calibration value of the other participant; based on the verification model, verify the parameter group of the other participant, the verification parameter calibration value of the other participant, the first signature parameter of the other participant, the second signature parameter of the other participant, the third signature parameter of the other participant and the signature share parameter of the other participant.

[0111] Exemplarily, the verification model may satisfy the following formula:

[0112]

[0113] in, is the first parameter in the parameter group of the other participant p1-i, is the first elliptic curve point of the other party, M1-i is the modulus of the other party, is the verification parameter calibration value of the other party, G is the generator of the elliptic curve group, t1-i is the second signature parameter of the other party, Δ1-i is the secret parameter of the other party, s1-i is the first signature parameter of the other party, V1-i is the third signature parameter of the other party, The signature share parameter of the other party.

[0114] According to the participants provided by the present invention, two participants respectively generate their own random parameters based on the point multiplication operation and pseudo-random function on the elliptic curve, and then generate their own signature shares and merge them to obtain a digital signature; under the consideration of the same security level, the point multiplication operation on the elliptic curve can be used to replace the power multiplication operation on the large integer field when using a nonlinear pseudo-random function in the traditional Schnorr signature, providing a smaller key size; thereby, the distributed deterministic threshold signature scheme based on the Schnorr signature can be combined with the elliptic curve cryptography system to obtain a more efficient and compact signature method.

[0115] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0116] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A method for generating a deterministic threshold elliptic curve digital signature, characterized in that: Applicable to the participants of deterministic threshold elliptic curve digital signature generation, including: Based on a pseudo-random function and a point multiplication operation on an elliptic curve, the signature share parameters and related certificates of the participant are generated according to the signature key of the participant and the message to be signed; and the signature share parameters and related certificates of the participant are sent to another participant; Verify the signature share parameters and related proof of the other party according to the verification key of the party; If the verification is successful, the signature parameters are calculated based on the signature share parameters of the participant and the other participant; Generate the signature share of the participant according to the signature parameter, the message to be signed, the joint public key, and the signature private key of the participant, and send the signature share of the participant to the other participant; A digital signature of the message to be signed is generated according to the signature shares of the participant and the other participant.

2. The method according to claim 1, characterized in that The method of generating the signature share parameters and related proofs of the participant according to the signature key of the participant and the message to be signed based on the pseudo-random function and the point multiplication operation on the elliptic curve includes: Based on the pseudo-random function, generate a first random parameter and a second random parameter of the party according to the signing key of the party and the message to be signed; Finding a parameter group of the participant that meets preset conditions; Based on the point multiplication operation on the elliptic curve, generate the first signature parameter and the second signature parameter of the participant according to the parameter group of the participant and the second random parameter of the participant respectively; Generate a relevant certificate of the participant according to the parameter group of the participant, the first signature parameter of the participant, the second signature parameter of the participant and the second random number of the participant; Generate the signature share parameter of the participant according to the first random parameter of the participant.

3. The method according to claim 2, characterized in that The first signature parameter satisfies the following formula: Wherein, si is the first signature parameter of the participant Pi, i=0,1; is the second parameter in the parameter group of the participant, and G is the generator of the elliptic curve group; The second signature parameter satisfies the following formula: ti=vi·G Among them, ti is the second signature parameter of the participant Pi, and vi is the second random parameter.

4. The method according to claim 2, characterized in that: The verifying the signature share parameters and related proof of the other party according to the verification key of the party includes: Based on the pseudo-random function, generating a verification parameter of the other party according to the verification key of the party; Disassembling the relevant certificate of the other participant to obtain the parameter group, the first signature parameter, the second signature parameter and the third signature parameter of the other participant, wherein the third signature parameter of the other participant is generated according to the second random number of the other participant; Calibrate the verification parameter of the other party according to the parameter group of the other party to obtain a verification parameter calibration value of the other party; Based on the verification model, verify the parameter group of the other participant, the verification parameter calibration value of the other participant, the first signature parameter of the other participant, the second signature parameter of the other participant, the third signature parameter of the other participant and the signature share parameter of the other participant.

5. The method according to claim 4, characterized in that The verification model satisfies the following formula: in, is the first parameter in the parameter group of the other participant p1-i, is the first elliptic curve point of the other party, M1-i is the modulus of the other party, is the verification parameter calibration value of the other party, G is the generator of the elliptic curve group, t1-i is the second signature parameter of the other party, Δ1-i is the secret parameter of the other party, s1-i is the first signature parameter of the other party, V1-i is the third signature parameter of the other party, is the signature share parameter of the other party.

6. A deterministic threshold elliptic curve digital signature generation participant, characterized in that: Including signature module, communication module and verification module; The signature module is used to generate the signature share parameters and related certificates of the participant according to the signature key of the participant and the message to be signed based on a pseudo-random function and a point multiplication operation on an elliptic curve; The communication module is used to send the signature share parameters and related certificates of the participant to another participant, and receive the signature share parameters and related certificates of the other participant; The verification module is used to verify the signature share parameters and related certificates of the other party according to the verification key of the party; If the verification is successful, the signature module is further used to calculate the signature parameters according to the signature share parameters of the participant and the other participant, and generate the signature share of the participant according to the signature parameters, the message to be signed, the joint public key, and the signature private key of the participant; The communication module is also used to send the signature share of the participant to the other participant and accept the signature share of the other participant; The signature module is also used to generate a digital signature of the message to be signed based on the signature shares of the participant and the other participant.

7. The participant according to claim 6, characterized in that: The signature module is specifically used for: Based on the pseudo-random function, generate a first random parameter and a second random parameter of the party according to the signing key of the party and the message to be signed; Finding a parameter group of the participant that meets preset conditions; Based on the point multiplication operation on the elliptic curve, generate the first signature parameter and the second signature parameter of the participant according to the parameter group of the participant and the second random parameter of the participant respectively; Generate a relevant certificate of the participant according to the parameter group of the participant, the first signature parameter of the participant, the second signature parameter of the participant and the second random number of the participant; Generate the signature share parameter of the participant according to the first random parameter of the participant.

8. The participant according to claim 7, characterized in that: The first signature parameter satisfies the following formula: Wherein, si is the first signature parameter of the participant Pi, i=0,1; is the second parameter in the parameter group of the participant, and G is the generator of the elliptic curve group; The second signature parameter satisfies the following formula: ti=vi·G Among them, ti is the second signature parameter of the participant Pi, and vi is the second random parameter.

9. The participant according to claim 7, characterized in that: The verification module is specifically used for: Based on the pseudo-random function, generating a verification parameter of the other party according to the verification key of the party; Disassembling the relevant certificate of the other participant to obtain the parameter group, the first signature parameter, the second signature parameter and the third signature parameter of the other participant, wherein the third signature parameter of the other participant is generated according to the second random number of the other participant; Calibrate the verification parameter of the other party according to the parameter group of the other party to obtain a verification parameter calibration value of the other party; Based on the verification model, verify the parameter group of the other participant, the verification parameter calibration value of the other participant, the first signature parameter of the other participant, the second signature parameter of the other participant, the third signature parameter of the other participant and the signature share parameter of the other participant.

10. The participant according to claim 9, characterized in that: The verification model satisfies the following formula: in, is the first parameter in the parameter group of the other participant p1-i, is the first elliptic curve point of the other party, M1-i is the modulus of the other party, is the verification parameter calibration value of the other party, G is the generator of the elliptic curve group, t1-i is the second signature parameter of the other party, Δ1-i is the secret parameter of the other party, s1-i is the first signature parameter of the other party, V1-i is the third signature parameter of the other party, is the signature share parameter of the other party.

Images